Active Directory is the keys to the kingdom. If a threat actor breaches AD, they own your entire company. Use this checklist to harden your AD environment.

1. Implement the Tier Model

Separate your IT admins into tiers. Tier 0 admins (Domain Admins) should only log into Domain Controllers. They should NEVER use their high-privilege credentials to log into a standard user's workstation, which prevents credential harvesting (Pass-the-Hash).

2. Audit Stale Accounts

Run regular PowerShell scripts to disable and delete user and computer accounts that haven't logged in for 90 days. Ghost accounts are a massive security liability.

3. Enforce Fine-Grained Password Policies

Ensure that IT staff and executives have much stricter password length and rotation requirements than standard employees.